Pinned post
light finds the crack, water makes one.
both get through
only the timeline is different
both get through
only the timeline is different
Raiders
Verified account This account is verified. Learn more@__Raiders
Full-stack Security Engineer & GTM Advisor | 2× @ethereumfndn Grantee | ETHSecurity Badge @thedaofund | Founder @Web3Sec_News & DigiBastion.com | 🦭 @_SEAL_Org
2.9K Following 2.9K Followers 8.7K Posts
Latest posts 5
the bar was never finding the bug. It was "writing the exploit" - ifykyk!
this used to take real skill and a week of work but now it only takes an afternoon & a decent prompt.
we didn't get more attackers suddenly btw, now everyone has the tool to write "vibehack"
this used to take real skill and a week of work but now it only takes an afternoon & a decent prompt.
we didn't get more attackers suddenly btw, now everyone has the tool to write "vibehack"
Binance did not lose its keys. It lost control of what those keys would sign.
Go check yours today:
> Can your signer sign a raw digest it never decoded?
> Would it sign an EIP-7702 authorization for a custodial hot wallet? It should never need to.
> Is signing scoped per chain and wallet tier, or is it one path for everything?
> Do you alert on delegation changes, or only on balance drops?
If you cannot answer those in a minute, that is the answer.
Go check yours today:
> Can your signer sign a raw digest it never decoded?
> Would it sign an EIP-7702 authorization for a custodial hot wallet? It should never need to.
> Is signing scoped per chain and wallet tier, or is it one path for everything?
> Do you alert on delegation changes, or only on balance drops?
If you cannot answer those in a minute, that is the answer.
View quoted post on X
If your AI agent browses the web on the same machine as your keys or your wallet, do these four things today.
- Check what you're running: ls ~/.cache/ms-playwright (macOS: ~/Library/Caches/ms-playwright). chromium-1248 means you're on the stale build.
- Point it at your real Chrome instead: channel: 'chrome' and chromiumSandbox: true
- Pin your MCP version. Stop using @latest.
- Container anything that visits sites you don't control. Keep hot keys off that machine entirely.
Why:
Playwright 1.64.1 bundles Chromium 156.0.8078.4. Chrome stable has been on 156.0.8078.79 since Oct 29. There is no 1.65 stable, so there is nowhere to upgrade to right now.
And Playwright launches Chromium with the sandbox off by default. Their own docs: chromiumSandbox defaults to false. The sandbox is what stops a bad page from reaching the rest of your machine.
Stale browser, no sandbox, and an exploit runs as your user. Files, SSH keys, .env, live sessions, signing material if it's on the box.
The bugs, all triggered by loading a page:
- CVE-2026-118306 (9.6), memory corruption in FileSystem, escapes the sandbox on its own
- Three more at 8.8: CVE-2026-118331, CVE-2026-118348, CVE-2026-118344. A sandbox would normally contain these.
Not known exploited in the wild, and the realistic path is your agent getting steered to a hostile page.
Fix it anyway, it takes two minutes.
h/t @nisten
- Check what you're running: ls ~/.cache/ms-playwright (macOS: ~/Library/Caches/ms-playwright). chromium-1248 means you're on the stale build.
- Point it at your real Chrome instead: channel: 'chrome' and chromiumSandbox: true
- Pin your MCP version. Stop using @latest.
- Container anything that visits sites you don't control. Keep hot keys off that machine entirely.
Why:
Playwright 1.64.1 bundles Chromium 156.0.8078.4. Chrome stable has been on 156.0.8078.79 since Oct 29. There is no 1.65 stable, so there is nowhere to upgrade to right now.
And Playwright launches Chromium with the sandbox off by default. Their own docs: chromiumSandbox defaults to false. The sandbox is what stops a bad page from reaching the rest of your machine.
Stale browser, no sandbox, and an exploit runs as your user. Files, SSH keys, .env, live sessions, signing material if it's on the box.
The bugs, all triggered by loading a page:
- CVE-2026-118306 (9.6), memory corruption in FileSystem, escapes the sandbox on its own
- Three more at 8.8: CVE-2026-118331, CVE-2026-118348, CVE-2026-118344. A sandbox would normally contain these.
Not known exploited in the wild, and the realistic path is your agent getting steered to a hostile page.
Fix it anyway, it takes two minutes.
h/t @nisten
why is clear signing still optional?
if I'm holding the key I should be able to see what the transaction does without trusting the interface that handed it to me. Most devices still show you a hash and you approve on faith.
usual answer to this is "use a multisig."
Bybit had one.
three signers approved, all of them reading the same spoofed UI. The keys were fine.
if I'm holding the key I should be able to see what the transaction does without trusting the interface that handed it to me. Most devices still show you a hash and you approve on faith.
usual answer to this is "use a multisig."
Bybit had one.
three signers approved, all of them reading the same spoofed UI. The keys were fine.